CVE-2026-74236 GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler
An authenticated admin can delete arbitrary files as root via path traversal in the diagnostic file deletion handler.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74236?
CVE-2026-74236 is a high-severity path traversal vulnerability in GFI ClearView, published on 4 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root.
Weakness: CWE-22
Which versions are affected by CVE-2026-74236?
How do I fix CVE-2026-74236?
No fix has been published for CVE-2026-74236 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-74236 being exploited?
There is no known exploitation of CVE-2026-74236 in the wild and no public exploit code.
Sources
Also known as GHSA-wqg8-2mq9-qgvj.